---
title: "Revoke a token"
method: POST
path: "/revoke"
tags: ["POST revoke"]
---

# Revoke a token

`POST /revoke`

Revokes an access or refresh token. Returns HTTP 200 with an empty JSON object even when the token is unknown. Confidential clients must authenticate (for example `client_id` and `client_secret` in the body or HTTP Basic authentication).

## Request body

- OAuthRevokeRequest
  - `token` string, required — Access token or refresh token to revoke.
  - `token_type_hint` 'access_token' | 'refresh_token' — Optional hint which token type is supplied.
  - `client_id` string
  - `client_secret` string — Required for confidential clients (or use HTTP Basic authentication).

## Response `200`

Token revoked, or token unknown / already invalid (empty object).

- object

## Other responses

- `403` — Authenticated client is not allowed to revoke the given token.

---

[API](https://skmtc.net/healthsherpa/apis/health-insurance-quotes-api.md) · [All operations](https://skmtc.net/healthsherpa/apis/health-insurance-quotes-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/healthsherpa/health-insurance-quotes-api/revisions/3cbfff4e5929/schema)